Tenant Data Sharing with Insurers in Spain
As a tenant in Spain, you have rights over how your personal data is used and shared, including rental contracts, payment receipts and photos of the property. Insurers may request information to assess risks or handle claims, but such sharing must comply with the LOPDGDD and the GDPR and respect your privacy. This article explains what data can be requested, when its sharing is lawful, what consents or legal bases must exist and what steps to take if you believe data has been transferred without justification in Spain. It also offers practical steps to complain or limit the use of your data by insurance companies.
What tenant data can be shared
Insurers commonly ask for data that helps assess risk and manage claims: name, tax ID, bank details for refunds, rental contract details and photos of the property. They may also request incident reports, invoices or repair reports. The sharing of especially sensitive data (health, racial origin, beliefs) is only allowed in very specific cases and with additional safeguards under Spanish law.[1]
When sharing is lawful
Sharing can be lawful when there is a legal basis: performance of a contract (e.g., handling a claim), legal obligation, legitimate interest after balancing, or explicit consent from the tenant. The requested information must be adequate, relevant and limited to what is necessary. If an insurer asks for data unrelated to the insured matter, you can ask for an explanation and object under LOPDGDD and the GDPR.[2]
What you can do as a tenant
- Request in writing which data was requested and for what purpose.
- Ask for a copy of any consent the insurer claims to have.
- Object or limit sharing when there is no clear legal basis.
- Seek advice or contact tenant support services for guidance.
Frequently Asked Questions
- Can my landlord give my data to an insurer without telling me?
- Generally no; sharing must have a legal basis. If it is data necessary to perform the contract or handle a claim, it may be justified, but you should be informed and the sharing must be proportionate.
- What if the insurer requests sensitive data?
- Sensitive data requires more restrictive treatment; request the legal basis and refuse the sharing if there is no clear justification. You may file a complaint if appropriate.
- Can I ask them to delete data that is no longer necessary?
- Yes, you can request restriction or deletion when data is no longer necessary for the original purpose or when you withdraw consent.
How to proceed
- Gather documentation: contract, receipts, communications and photos that show the condition and events.
- Request in writing from the insurer and landlord which data was shared and on what legal basis.
- If the response is unsatisfactory, file a complaint with the Spanish Data Protection Agency or consider civil action.
- Contact tenant defense services or legal advice to evaluate concrete steps.
Help and resources
- [1] BOE — Consolidated text of the Urban Leases Act
- [2] BOE — Data protection (LOPDGDD)
- [3] Ministry of Justice — Guidance for civil procedures
